toolfactory 0.1.1

package/src/commands.test.ts

@@ -0,0 +1,253 @@
+/**
+ * The command layer's own behaviour: the step runner behind `gate`/`package`, the `gh`
+ * invocations `init --repo` makes (dry-run only — `gh` is not installed here and
+ * api.github.com is unreachable, so the shape is proved, never the call), and what `init`
+ * leaves behind in a real directory.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import * as commands from "./commands.js";
+import { createRepo } from "./hosts/github.js";
+import {
+  assertNoSensitiveArgument,
+  defaultSurfaces,
+  type Operation,
+  type Project,
+  type SurfaceId,
+  ToolConfigSchema,
+} from "./model.js";
+import { RELOAD } from "./surfaces/agents.js";
+
+function project(surfaces: SurfaceId[]): Project {
+  return {
+    root: "/repo",
+    tool: {
+      schemaVersion: 1,
+      identity: "plugin.json",
+      binding: "typescript",
+      surfaces,
+      bundle: { runtime: "package" },
+      tests: { examples: {} },
+    },
+    identity: { name: "probe", version: "0.1.0", description: "A probe tool" },
+    identityExtra: {},
+    operations: [],
+    toolfactoryVersion: "0.1.0",
+  };
+}
+
+const environment = { ...process.env };
+afterEach(() => {
+  process.env = { ...environment };
+});
+
+describe("runSteps", () => {
+  it("runs in order, skips CI-only provisioning, and stops at the first failure", () => {
+    const { steps } = commands.runSteps(tmpdir(), [
+      { name: "first", run: "true" },
+      { name: "provisioning", run: "exit 1", when: "ci" },
+      { name: "boom", run: "exit 3" },
+      { name: "never", run: "true" },
+    ]);
+    expect(steps.map((step) => [step.name, step.ok])).toEqual([
+      ["first", true],
+      ["boom", false],
+    ]);
+    expect(steps.every((step) => step.durationMs >= 0)).toBe(true);
+  });
+});
+
+describe("createRepo", () => {
+  it("dry-runs the exact gh invocations: private, from the checkout, one topic per surface", () => {
+    expect(
+      createRepo(project(["skill", "mcp", "openclaw-native", "cli"]), {
+        slug: "GoatInAHat/probe",
+        dryRun: true,
+      }),
+    ).toEqual({
+      repository: "GoatInAHat/probe",
+      visibility: "private",
+      topics: ["agent-skill", "mcp-server", "openclaw-plugin", "toolfactory"],
+      commands: [
+        'gh repo create GoatInAHat/probe --private --description "A probe tool" --source . --remote origin --push',
+        "gh repo edit GoatInAHat/probe --add-topic agent-skill,mcp-server,openclaw-plugin,toolfactory",
+      ],
+      dryRun: true,
+    });
+  });
+
+  it("makes the repository public only when asked", () => {
+    const { commands: lines } = createRepo(project(["mcp"]), {
+      slug: "GoatInAHat/probe",
+      public: true,
+      dryRun: true,
+    });
+    expect(lines[0]).toContain("--public");
+    expect(lines[0]).not.toContain("--private");
+  });
+});
+
+describe("init", () => {
+  it("initialises a git repository, commits, and reports the reload line of this harness", () => {
+    const dir = mkdtempSync(join(tmpdir(), "toolfactory-init-"));
+    process.env.CLAUDECODE = "1";
+    // No git identity, as on a CI runner: the first commit must still land.
+    process.env.GIT_CONFIG_GLOBAL = "/dev/null";
+    process.env.GIT_CONFIG_SYSTEM = "/dev/null";
+    // `setup: false`: `.agents/setup` installs dependencies, which belongs to the end-to-end
+    // proof in a real project, not to a unit test.
+    const result = commands.init({
+      root: dir,
+      name: "probe",
+      binding: "typescript",
+      surfaces: ["cli"],
+      repo: "GoatInAHat/probe",
+      dryRun: true,
+      setup: false,
+    });
+
+    expect(existsSync(join(dir, ".git"))).toBe(true);
+    expect(execFileSync("git", ["log", "--format=%s"], { cwd: dir, encoding: "utf8" }).trim()).toBe(
+      "toolfactory init",
+    );
+    expect(result.repository?.commands[0]).toBe(
+      "gh repo create GoatInAHat/probe --private --source . --remote origin --push",
+    );
+    // Nothing ran: no remote, and no live-tests bootstrap without a declared credential.
+    expect(execFileSync("git", ["remote"], { cwd: dir, encoding: "utf8" }).trim()).toBe("");
+    expect(result.repository?.secrets).toEqual([]);
+    expect(result.nextSteps[1]).toBe(RELOAD.find((row) => row.harness === "Claude Code")?.line);
+    expect(result.nextSteps[2]).toContain("src/ops.ts");
+    // `keywords` defaults to `[name]` — Kiro Powers and Agent Plugins key activation off it —
+    // and lands in the scaffolded identity file (`package.json`, here) like the rest of identity.
+    expect(JSON.parse(readFileSync(join(dir, "package.json"), "utf8")).keywords).toEqual(["probe"]);
+    // Asked for nothing, init selects the skills-first minimum; host plugins are opt-in.
+    expect(defaultSurfaces("python")).toEqual(["skill", "agent-plugins", "mcp", "cli", "pypi"]);
+  });
+
+  it("creates an instruction-only Codex plugin without a generated runtime", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "toolfactory-instructions-"));
+    const result = commands.init({
+      root: dir,
+      name: "paper-viz",
+      binding: "typescript",
+      runtime: "none",
+      surfaces: ["skill", "codex"],
+      git: false,
+      setup: false,
+    });
+
+    expect(existsSync(join(dir, "package.json"))).toBe(false);
+    expect(existsSync(join(dir, "src/toolfactory/mcp.ts"))).toBe(false);
+    expect(existsSync(join(dir, "mcp.json"))).toBe(false);
+    expect(
+      JSON.parse(readFileSync(join(dir, ".codex-plugin/plugin.json"), "utf8")),
+    ).not.toHaveProperty("mcpServers");
+    expect(readFileSync(join(dir, "skills/paper-viz/SKILL.md"), "utf8")).not.toContain(
+      "No operations yet",
+    );
+    expect(result.nextSteps[2]).toContain("SKILL.md");
+    await expect(commands.check(dir)).resolves.toBeDefined();
+  });
+
+  it("refuses runtime none with a surface that needs an executable payload", () => {
+    expect(() =>
+      ToolConfigSchema.parse({
+        schemaVersion: 1,
+        identity: "plugin.json",
+        binding: "typescript",
+        runtime: "none",
+        surfaces: ["skill", "mcp"],
+      }),
+    ).toThrow(/skill and codex surfaces/);
+  });
+});
+
+describe("secrets", () => {
+  it("inventories the tool's sensitive keys and the registries' tokens — presence only, never a value", () => {
+    const dir = mkdtempSync(join(tmpdir(), "toolfactory-secrets-"));
+    writeFileSync(join(dir, ".env"), "API_KEY=canary-3f9a\n");
+    const target = project(["cli", "npm"]);
+    target.root = dir;
+    target.tool.config = {
+      type: "object",
+      properties: {
+        api_key: {
+          type: "string",
+          "x-toolfactory": { sensitive: true, url: "https://example.com/keys" },
+        },
+      },
+      required: ["api_key"],
+    };
+    const report = commands.secretsReport(target);
+    expect(report.secrets.map((secret) => secret.name)).toEqual(["API_KEY", "NPM_TOKEN"]);
+    expect(report.secrets[0]).toMatchObject({
+      kind: "config",
+      required: true,
+      local: true,
+      url: "https://example.com/keys",
+    });
+    expect(report.secrets[1]).toMatchObject({
+      kind: "release",
+      required: false,
+      local: false,
+      needs: ["npm"],
+    });
+    expect(JSON.stringify(report)).not.toContain("canary-3f9a");
+  });
+
+  it("refuses an operation input named like a sensitive config key", () => {
+    const login = {
+      name: "login",
+      inputSchema: { type: "object", properties: { password: { type: "string" } } },
+      requires: [],
+    } as unknown as Operation;
+    expect(() =>
+      assertNoSensitiveArgument(
+        { properties: { password: { type: "string", "x-toolfactory": { sensitive: true } } } },
+        [login],
+      ),
+    ).toThrow(/"login" declares an input named "password"/);
+  });
+});
+
+describe("unpublish", () => {
+  it("diffs tool.json against the previous tag and retracts what a dropped surface published", () => {
+    const dir = mkdtempSync(join(tmpdir(), "toolfactory-unpublish-"));
+    process.env.GIT_CONFIG_GLOBAL = "/dev/null";
+    process.env.GIT_CONFIG_SYSTEM = "/dev/null";
+    commands.init({
+      root: dir,
+      name: "probe",
+      binding: "typescript",
+      surfaces: ["cli", "npm"],
+      dryRun: true,
+      setup: false,
+    });
+    const git = (...args: string[]) =>
+      execFileSync("git", args, {
+        cwd: dir,
+        encoding: "utf8",
+        env: {
+          ...process.env,
+          GIT_AUTHOR_NAME: "t",
+          GIT_AUTHOR_EMAIL: "t@example.com",
+          GIT_COMMITTER_NAME: "t",
+          GIT_COMMITTER_EMAIL: "t@example.com",
+        },
+      });
+    git("tag", "v0.1.0");
+    const toolPath = join(dir, "dev.toolfactory", "tool.json");
+    const tool = JSON.parse(readFileSync(toolPath, "utf8"));
+    tool.surfaces = tool.surfaces.filter((surface: string) => surface !== "npm");
+    writeFileSync(toolPath, JSON.stringify(tool, null, 2));
+    git("commit", "-qam", "drop npm");
+    git("tag", "v0.2.0");
+    const result = commands.unpublish(dir, { dryRun: true });
+    expect(result.dropped).toEqual(["npm"]);
+    expect(result.steps.some((step) => step.run.includes("npm deprecate probe@'*'"))).toBe(true);
+  });
+});